kw1281test: A Free VDS-Pro / VagTacho Alternative

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
If VCDS-Lite can't connect to the CCM then kw1281test won't be able to either. Maybe your CCM has a broken K-Line.
 

stallion_007

New member
Joined
Jun 30, 2025
Location
Asheville, NC
TDI
2009 New Beetle
Is there a way to check the CCM for power and broken K-Line? Also, my daughter had taken this car to a locksmith recently, and they were able to program a new key so I am assuming the CCM was working a few months ago?
 

P2B

Top Post Dawg
Joined
Jan 11, 2006
Location
Toronto & Muskoka, Canada
TDI
2002 Jetta, 2003 Jetta, 2003 Jetta Wagon
Is there a way to check the CCM for power and broken K-Line? Also, my daughter had taken this car to a locksmith recently, and they were able to program a new key so I am assuming the CCM was working a few months ago?
Key programming does not require CCM access.
 

berre

Member
Joined
Mar 7, 2024
Location
Belgium
TDI
Passat Variant 3B5
This is probably going to be a long post, because some context is necessary, but I'll try to keep it concise.

I own a 1998 Passat Variant, 3B5, with the 1.9 turbo diesel AHU engine, 66 kw. I've been addressing all kinds of issues, got it through technical inspection (here in Belgium), etc. I have recently lost engine performance, but a new turbo and vacuum lines have been ordered and I'm gonna install it soon. Might have to buy some new sensors too.

The instrument cluster has 'misbehaved' since the moment I got it, which is 2 years ago now; except for the speedometer, the values were wrong. The needles for rpm and fuel tank volume move, but their 'zero' is competely wrong (e.g. 0rpm = 1900rpm on the dial). Also, the red display doesn't work.

Earlier tonight I checked again if I could get the shareware version of vcds-lite working, this time with a cable with a ch340 chip, after my earlier attempt with an ftdi chip based cable was unsuccesfull.
This time it worked, and I decided to try an 'auto-scan'. During the scanning, which took quite a while, the needles moved 'around the place', and after finishing the needles for speed, engine temp and fuel tank volume stayed in the 'maxed out' position. I disconnected the car battery for a while, but when I turn the ignition on that's still exactly what I get: +1900 for the rpm value, and the needles for speed, tank volume and engine temp in their highest position (further than what's on the dial).
The needles move if I start the car, or in any case the one for fuel tank volume - had to stop testing though as I don't have a battery charger at the moment.

I can monitor vehicle speed with gps on my phone, for now. Fuel tank volume is more inconvenient; before it indicated (a lot) less than was in the tank, giving me some indication at least, while now it indicates way more than what's actually there.

I like kw1281test, have been reading the documentation. Using the command line is no issue, but as I'm a (car) noob there's still a lot I don't understand. Is there a way to reset the needles? Should I maybe take out the cluster and move the needles physically? Or would it be best to replace the cluster? In case the last option is the best, I guess I should have the skc/pin of the replacement cluster?

Thx in advance for any replies.
 

Nuje

Top Post Dawg
Joined
Feb 11, 2005
Location
Island near Vancouver
TDI
2002 Golf 6MT; 2015 Sportwagen 6MT; 2018 A3 e-tron 6DSG
So, when the engine is turned off (key out of ignition), are the needles sitting at "zero"? Or are they all in the wrong place - like the RPM needle is at 1900 even with the engine turned off?

If so, it's easy to pop out the needles and rotate them backwards (counter-clockwise) so that the needle now sits at zero. Probably some videos on youtube, but the hardest part is be unplugging the blue and green connectors from the back of the cluster. After you have it out, you simply undo two T10 (maybe T15?) screws, pull the cluster apart, then you can rotate the needles to wherever you want them to have as their "zero" position.
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
You can use the kw1281test "ActuatorTest" command (or I think called "Output Test" in VCDS) to test the needle alignment. The needles will each sweep from min to max and then stop at a specific midpoint (50% for fuel gauge and coolant temp, 100km/h for speedo, 3000rpm for tach). Plus it will test all the lights and the alert sounds.
 

berre

Member
Joined
Mar 7, 2024
Location
Belgium
TDI
Passat Variant 3B5
Thx for the feedback!

Yes with the key out of the ignition, rpm is at 1900, and the needles for engine temp and speed are beyond the scale, maxed out so to speak. I'm gonna look into moving the needles. Probably best to do that first and then do the kw1281test 'ActuatorTest' command, I guess?
 

berre

Member
Joined
Mar 7, 2024
Location
Belgium
TDI
Passat Variant 3B5
I got the cluster out, put the needles in the right place, and did the ActuatorTest command.... Had to use a baud rate of 9600 in stead of 10400 (I tried that first, but after that failed the software suggested trying another rate, which is convenient (y)).

All gauges work now as they should, I wasn't able to make a bluetooth connection between my phone and my OBD dongle so couldn't get live data, but rpm values seem normal. Indicated speed is a bit higher than what it actually is, 3km/h or so, might have bumped the needle when putting things back together but it's not a serious issue. Tank volume is correct (filled it up), engine temp seems to be correct too (have to verify more accurately).

Thx a LOT for this software (I love open source stuff!), as well as the advice given.
 

ecala001

Veteran Member
Joined
Aug 17, 2020
Location
California
TDI
03 golf
For skc would it be 1451?

Received "Read EEPROM Response" block: AB 05 AB 05 AB 05

This is on a 05 bew
Sending Custom "Unlock Additional Commands" block

00: VWK503LL $00 $09

01: $58 $20

02: $13 $0B $02 $0D $35 $04

03: VW/Sk LL ROM-Maske

Sending Custom "Unlock partial EEPROM read" block

Unlock code for software version 'VWK503LL 09.00 is 3E 35 3D 3A

Sending Custom "Get Access Level" block

Access level is 4.

Sending Custom "Seed request" block

Block: C4 C3 E4 5B E4 07 DO 35 01 00

Access level 7 secret: $55 $16 $A8 $94

Sending Custom "Key response" block

Sending Custom "Get Access Level" block

Access level is 7.

Cluster is unlocked for ROM/EEPROM access.

Saving EEPROM dump to 3VWSR69M15M024560_____VWZ7Z0D0137567_$010A_eeprom.bin

Sending ReadEeprom block (Address: $010A, Count: $06)

Received "Read EEPROM Response" block: AB 05 AB 05 AB 05

Saved EEPROM dump to 3VWSR69M15M024560_____VWZ7Z0D0137567_$010A_eeprom.bin

Sending EndCommunication block
 
Last edited:

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
For skc would it be 1451?

Received "Read EEPROM Response" block: AB 05 AB 05 AB 05

This is on a 05 bew
Yes, SKC should be 01451.

Also, in case you didn't know, kw1281test has a GetSKC command that will usually be able to calculate the SKC for you.
 

ecala001

Veteran Member
Joined
Aug 17, 2020
Location
California
TDI
03 golf
Yes, SKC should be 01451.

Also, in case you didn't know, kw1281test has a GetSKC command that will usually be able to calculate the SKC for you.
Got it to successfully pair the new (used) cluster and key matching. However, I noticed there are two vins now on the extra field. Did I mess something up?

Also how can fix the milage on the cluster for a bew? I have 297k on original cluster and new one shows 230k. I need it to match for upcoming smog

Edit:::
Was able to edit it using vag eeprom programmer to match my original cluster. The weird thing is that vcds ECU mileage shows 296215 miles and my cluster reads 297106. Not sure if this will get flagged when I get smog. 297107 was the number prior to replacement as the used cluster was at 230k.
***Note not trying to do anything malicious, just trying to match what I initially had.
 
Last edited:

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
Got it to successfully pair the new (used) cluster and key matching. However, I noticed there are two vins now on the extra field. Did I mess something up?
Are both "VINs" 17 characters long? Or is one 17 characters long (which would indicate a VIN) and the other 14 characters long (which would indicate an immobilizer ID)?

The weird thing is that vcds ECU mileage shows 296215 miles and my cluster reads 297106.
VCDS ECU mileage is not exact like the cluster mileage: https://www.ross-tech.com/vcds/tour/EDC-15-Mileage.php
 

gmenounos

Vendor
Joined
Jun 26, 2003
Location
Watertown, MA, USA
TDI
'99.5 Golf GLS, '01 Jetta GLX Wagon (TDI conversion), Non-TDI: '23 Tesla Model 3 AWD
I'm guessing one VIN is from your car and the other VIN is from the car the cluster was removed from. I feel like I read this somewhere but I searched around and can't find the info anymore.
 

ecala001

Veteran Member
Joined
Aug 17, 2020
Location
California
TDI
03 golf
I'm guessing one VIN is from your car and the other VIN is from the car the cluster was removed from. I feel like I read this somewhere but I searched around and can't find the info anymore.
I found the thread. However, is it possible to do it with the vag eeprom programmer? I'm afraid to brick it lol

 

TDI_FNG

Well-known member
Joined
Jan 28, 2013
Location
Kirkland, WA
TDI
2004 Jetta
I sent my Passat's cluster to Cluster's by Litke to have him replace the MFA screen, when I got it back, the needles were backlit whenever the key was on (rest of the cluster backlighting remains off until you turn on the lights), the needles do a min to max sweep when you first key it on, and my cruise control light now only comes on when I engage cruise instead of just on when the main switch is set to "ON".

Well, that sent me down a rabbithole, poking around on the old Nefmoto website to find this handy reference: http://nefariousmotorsports.com/forum/index.php?topic=7964.msg74241#msg74241

This is *only* for VWK501 and 503 software clusters. Sorry Immo II owners, you're left out yet again.

After some further research to find how the needle sweep is performed, it turns out it only applies to MFA screen and full FIS screen-equipped clusters. I guess the lower end clusters don't support it. Graeme's webspace has the tutorial on how to do the needle sweep for those clusters. Again, have to differentiate if you have 501 or 503 software first, and then there's further differentiation on each of those pages depending on a more specific variation of the chip/software the cluster has--he walks you through each.

But, happily, the other hacks mentioned do indeed work on standard 501 and 503 non-MFA/FIS clusters. The better half has a 2003 Jetta wagon and it now features full time backlit needles and a cruise control light that only comes on if SET cruise and is actively engaged. The moment cruise gets canceled for any reason, the light goes back off.

I've also been poking around howtos on making the coolant temp gauge more linear. Finding out you need to graph on an x and y plot two lines of code. On 501 software clusters, it's the first 12 bits started with 0x2E (0-A) as your Y axis, 0x2D (4-E) as your X axis. Only really need to modify 2 pairs of bytes in the middle of 0x2E line (two bytes make up one decimal value of the mapping--and it's read from right to left). If you want it 100% linear, you really could just copy 0x2D4-0x2DE and paste it to 0x2E0-0x2EA. Inspired by the post found here--but not totally sold on how a simple straight line was made...

Or, if you'd prefer some minor amount of buffering on the low end--where the needle doesn't even start moving until the engine has adequate temp--leave the first 4 bytes alone, and also leave the last 4 alone, only modifying the 4 bytes in the middle (0x2E4-0x2E7).

This keeps the not as linear moves on the extreme ends of the scale, which I kind of like, but you can make the range in the middle perfectly linear. What I mean by that is the needle stays pegged on cold while the engine is warming up, it's more useful info to me to only have it start to come off the full cold mark only when the engine actually has adequate temp in it to not have to be so easy on it vs. a linear reading that might move much sooner on that end of the scale.

Likewise on the high end of the scale, as you start to get above 108 C, the needle will start to move a fair bit faster to the high end. The original mapping basically has it so the needle is practically dead in the middle from the mid 70 C range to just above 108 C. And since there are only 6 values to set the curve of the needle's response, it makes some sense to keep the gauge's original behavior on the extreme ends of the scale, but make the middle operating range more linear.

This is how that would look plotted on a graph: View attachment 143441

Original mapping on the top graph, lower graph just has the two sets of middle bytes changed to be 1:1 with the X axis. Effectively, you could take the decimal value of the two bytes and divide them by 8 and you'd actually get the temp value in Celsius.

So, originally on the cluster shown, it was 761 on the one axis while it read between 592 and 861 decimal values. Divide by 8, you get what that is in Celsius.

592 = 74 C
864 = 108 C
761 = 95.125 C

So, in the case of this 501 software cluster, you'd convert (Windows calculator has a "programmer" mode that makes conversions super fast and easy) the following addresses:

0x2E4: 50 (originally F9)
0x2E5: 02 (originally 02)
0x2E6: 60 (originally F9)
0x2E7: 03 (originally 02)

Values in hexadecimal, not decimal. The EEPROM reads *pairs* of bytes in this case--the byte pairs are read in reverse (right to left) but the pairs are ordered from lowest to highest, read left to right, somewhat confusingly because there's a mix of both left to right and right to left ordering going on... heh

So, you're reading the first value we're changing, starting with 0x2E5 plus 0x2E4 in that order. The second value is 0x2E7 plus 0x2E6 in that order. When you read left to right, they read F9 02 in both pairs of bytes in the original calibration in this instance. But the EEPROM reads them as 02 F9. So, if you enter F9 02 into the "Programmer mode" Windows calculator to convert to decimal you'd get 63746! That's definitely not right. If you enter 02 F9 and convert to decimal value, you get 761 of the combined two bytes--that's more like it.

So, bytes 4-5 is being read as 0250 by the EEPROM, even though the order you normally read them as 5002 left to right.

0250 in hex to decimal is 592. If you got them reversed and the EEPROM reads it as 5002, that would be 20,482. lol. So yeah, important to get it right!

Might have to play with this as each car may actually center their gauge a little different, the two clusters I've looked at for the temp mapping were setup noticeably different. The values in 0x2D seem to remain constant, but how the gauge is setup to respond to 0x2E sometimes varies a little.

I did dump the entire cluster eeprom and back them up with KW1281test before modifying. But, now that I better understand what I'm looking at, I can go in and change individual byte addresses to effect the change I'm after. I did modify, in a hex editor, the two files I have and saved them to try on the respective vehicles in question instead of modifying the individual byte addresses, but when you get the values spelled out for you, it's sometimes faster just to change the handful of addresses you want individually than it is to dump the entire thing and then reupload the complete file.
On my 2004 Jetta (BEW) I found my temperature addresses were off by 38 bytes (thanks to https://passatworld.ru/entry.php/558-Kalibrovka) . So instead of 0x2D4 mine started at 0x30C. But it did have the 'flat spot' right where it was supposed to be. It was easy enough to get it reasonably close and then my OCD kicked in. It took a few hours of testing and tweaking but now the needle is dead on balls accurate (it's an industry term, look it up) between 140F and 206F. I left the last 2 pair of bytes alone, so I should be OK on the extreme high end.

It is going to take some getting used to seeing the temp fluctuate with driving condition as it went 1 tick over 190F (206F) while stuck in traffic, and I have NEVER seen it do that before in the 10+ years I have owned the car. lol

AWESOME PROGRAM DUDE!!!!!

Now that I understand the mapping better, I can't wait to tackle the speedometer offset. And yes, I have the factory eeprom stored safely away on 3 different devices, just in case I total screw the pooch.
 

Matt-98AHU

Loose Nut Behind the Wheel Vendor
Joined
Apr 23, 2006
Location
Gresham, OR
TDI
2001 Golf TDI, 2005 Passat wagon, 2004 Touareg V10.
On my 2004 Jetta (BEW) I found my temperature addresses were off by 38 bytes (thanks to https://passatworld.ru/entry.php/558-Kalibrovka) . So instead of 0x2D4 mine started at 0x30C. But it did have the 'flat spot' right where it was supposed to be. It was easy enough to get it reasonably close and then my OCD kicked in. It took a few hours of testing and tweaking but now the needle is dead on balls accurate (it's an industry term, look it up) between 140F and 206F. I left the last 2 pair of bytes alone, so I should be OK on the extreme high end.

It is going to take some getting used to seeing the temp fluctuate with driving condition as it went 1 tick over 190F (206F) while stuck in traffic, and I have NEVER seen it do that before in the 10+ years I have owned the car. lol

AWESOME PROGRAM DUDE!!!!!

Now that I understand the mapping better, I can't wait to tackle the speedometer offset. And yes, I have the factory eeprom stored safely away on 3 different devices, just in case I total screw the pooch.
Yeah. Your BEW almost certainly has VWK503 software. A lot of addresses for such things are different from the VWK501 I was working on.

I did do a similar hack on a VWK503 Passat cluster recently. Overall, I like it. Simple enough to just change the two pairs of bytes in that middle range to make it accurate through that center range.
 
Top